Update expected leaks - #52
L-Jubarah-upb wants to merge 78 commits into
Conversation
Removed expected info flows from JSON file.
Updated documentation to reflect changes in data flow and leak status.
Updated the number of leaks in the documentation and adjusted log statements to prevent leaks.
Removed expected info flows related to SMS and device ID.
Added new source and sink information for data flow.
Updated the number of leaks in the documentation and added a comment indicating the log statement as a sink.
Updated the number of leaks in the documentation from 1 to 2.
| @Override | ||
| public void onClick(View arg0) { | ||
| cFuncDoTheMagic(getApplicationContext()); | ||
| cFuncDoTheMagic(getApplicationContext()); // source, sink |
There was a problem hiding this comment.
IMHO: The expressiveness of our specification does not allow to specify the source/sinks here accurately.
@StevenArzt Your opinion?
There was a problem hiding this comment.
According to Steven we should put the source and sink specification into the native C code file
There was a problem hiding this comment.
The source and sink are in native code. There are tools out there that support native code analysis, so we should be precise here and remove the annotation on the Java side. Otherwise, we would put a malus on tools that are actually more precise.
|
|
||
| try { | ||
| String string = "dIeciveDteg"; | ||
| String string = "dIeciveDteg"; // source |
There was a problem hiding this comment.
No, the source is:
id = (String) method.invoke(telephonyManager);
There was a problem hiding this comment.
Note that the source in the JSON should still say android.telephony.TelephonyManager: java.lang.String getDeviceId() , since the trackers need to resolve the reflective API call.
| "Line": 30 | ||
| "Source": "android.telephony.TelephonyManager: java.lang.String getDeviceId()", | ||
| "Method": "com.example.onlytelephony.MainActivity: void onCreate(android.os.Bundle)", | ||
| "Line": 54 |
There was a problem hiding this comment.
Line 63 (the one with the reflective method invoke)
| .getSystemService(Context.TELEPHONY_SERVICE); | ||
| method = c.getMethod(string, new Class<?>[0]); | ||
|
|
||
| id = (String) method.invoke(telephonyManager); |
| method = c.getMethod(reverse, new Class<?>[0]); | ||
| Toast.makeText(this, "tele manager is executed", Toast.LENGTH_SHORT) | ||
| .show(); | ||
| id = (String) method.invoke(telephonyManager); |
|
Thanks for you contribution! I've added a few comments on things that should be improved. |
Updated line number for getExtras() in expected-info-flows.json.
Updated log message to clarify source and sink.
Thank you for your comments! I've updated a few things but some others are still open. Can you please check my comments? |
3 participants
No description provided.